@homeflare/alchemy 0.44.0 → 0.46.0

package/src/postgres/role-password-ascii.test.ts

@@ -0,0 +1,53 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeSql } from './fake-sql.ts';
+import { diffPostgresRole } from './role-diff.ts';
+import { reconcileWithClient } from './role.ts';
+import { seal } from '../secrets/write-only.ts';
+import type { PostgresRoleAttributes } from './role-attrs.ts';
+
+const props = {
+  name: 'ascii-seat',
+  login: true,
+  inherit: true,
+  connectionLimit: -1,
+  password: { fromEnv: 'TEST_PASSWORD' },
+};
+const live: PostgresRoleAttributes = {
+  ...props,
+  oid: 42,
+  validUntil: null,
+  memberOf: [],
+  passwordSeal: '',
+};
+
+// Synthetic values cover SASLprep mapping, normalization and invalid Unicode; never credentials.
+test.each(['soft\u00adhyphen', 'caf\u00e9', '\u2168', '\ud800'])(
+  'non-ASCII case %# refuses create, adopt, sealed reconcile and diff without exposing input',
+  async (password) => {
+    const env = { TEST_PASSWORD: password };
+    const passwordSeal = seal({ password }, 'test-salt');
+    for (const exists of [false, true]) {
+      const fake = makeFakeSql({ roleRows: exists ? [live] : [] });
+      for (const previous of ['', passwordSeal]) {
+        const error = await Effect.runPromise(
+          reconcileWithClient(fake, props, env, previous).pipe(
+            Effect.catchTag('PostgresRolePasswordNonAsciiRefused', Effect.succeed),
+          ),
+        );
+        expect(error).toMatchObject({
+          _tag: 'PostgresRolePasswordNonAsciiRefused',
+          role: props.name,
+        });
+        expect(JSON.stringify(error)).not.toContain(password);
+        expect(fake.statements).toEqual([]);
+      }
+    }
+    const error = await Effect.runPromise(
+      diffPostgresRole(props, { ...live, passwordSeal }, env).pipe(
+        Effect.catchTag('PostgresRolePasswordNonAsciiRefused', Effect.succeed),
+      ),
+    );
+    expect(error).toHaveProperty('_tag', 'PostgresRolePasswordNonAsciiRefused');
+  },
+);

package/src/postgres/role-password-transports.test.ts

@@ -0,0 +1,123 @@
+/** Capture the actual Effect SQL spans and psql stdin, not just the builder's output. */
+import { expect, test } from 'bun:test';
+import * as PgClient from '@effect/sql-pg/PgClient';
+import * as Effect from 'effect/Effect';
+import * as Stream from 'effect/Stream';
+import * as Tracer from 'effect/Tracer';
+import * as Statement from 'effect/unstable/sql/Statement';
+import type { Connection } from 'effect/unstable/sql/SqlConnection';
+import type { PgExecutor } from './database-sql.ts';
+import { makeFakeSql } from './fake-sql.ts';
+import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
+import { reconcileWithClient } from './role.ts';
+
+const props = {
+  name: 'transport-seat',
+  login: true,
+  inherit: true,
+  connectionLimit: -1,
+  password: { fromEnv: 'TEST_PASSWORD' },
+};
+// Synthetic test input, deliberately recognizable if it escapes into captured telemetry.
+const password = 'kit336-plaintext-canary:must-never-reach-transport!';
+const env = { TEST_PASSWORD: password };
+const live = { ...props, oid: 42, validUntil: null, memberOf: [], passwordSeal: '' };
+
+test('SQL tracer captures only a verifier on create, rotate and failed ALTER', async () => {
+  for (const exists of [false, true]) {
+    for (const fail of [false, true]) {
+      const fake = makeFakeSql({
+        roleRows: exists ? [live] : [],
+        ...(fail ? { failNext: 'ALTER ROLE' } : {}),
+      });
+      const spans: Tracer.Span[] = [];
+      const tracer = Tracer.make({
+        span: (options) => {
+          const span = Tracer.nativeTracer.span(options);
+          spans.push(span);
+          return span;
+        },
+      });
+      const execute: Connection['execute'] = (sql, params) => fake.unsafe(sql, params);
+      const connection: Connection = {
+        execute,
+        executeUnprepared: execute,
+        executeRaw: (sql, params) => fake.unsafe(sql, params),
+        executeValues: () => Effect.succeed([]),
+        executeValuesUnprepared: () => Effect.succeed([]),
+        executeStream: () => Stream.empty,
+      };
+      // Use the installed SQL Statement and PG compiler: db.query.text is set by Effect,
+      // while only the connection beneath it is fake. A hand-written span would prove nothing.
+      const sql = Statement.make(
+        Effect.succeed(connection),
+        PgClient.makeCompiler(),
+        [],
+        undefined,
+      );
+      const pg: PgExecutor = {
+        unsafe: (text, params) => sql.unsafe(text, params),
+        transaction: (texts) =>
+          Effect.gen(function* () {
+            for (const text of texts) yield* sql.unsafe(text);
+          }),
+      };
+      const result = await Effect.runPromise(
+        Effect.exit(reconcileWithClient(pg, props, env, exists ? 'stale-seal' : '')).pipe(
+          Effect.provideService(Tracer.Tracer, tracer),
+        ),
+      );
+      expect(result._tag).toBe(fail ? 'Failure' : 'Success');
+      const attributes = spans.map((span) => Object.fromEntries(span.attributes));
+      const passwordQueries = attributes
+        .map((a) => a['db.query.text'])
+        .filter((text): text is string => typeof text === 'string' && text.includes('PASSWORD'));
+      expect(passwordQueries).toHaveLength(1);
+      expect(passwordQueries[0]).toContain("PASSWORD E'SCRAM-SHA-256$");
+      expect(JSON.stringify({ attributes, result })).not.toContain(password);
+    }
+  }
+});
+
+test('psql runner receives only a verifier; echoed failure and state hold no plain value', async () => {
+  for (const exists of [false, true]) {
+    for (const fail of [false, true]) {
+      const calls: Parameters<PsqlRunner>[0][] = [];
+      let created = exists;
+      const run: PsqlRunner = (call) => {
+        calls.push(call);
+        if (call.stdin.includes('PASSWORD') && fail) {
+          return Promise.resolve({
+            code: 3,
+            stdout: '',
+            stderr: `ERROR:  42501: refused\nSTATEMENT: ${call.stdin}`,
+          });
+        }
+        if (call.stdin.startsWith('BEGIN')) created = true;
+        return Promise.resolve({
+          code: 0,
+          stderr: '',
+          stdout: call.stdin.includes('FROM pg_roles r')
+            ? JSON.stringify(created ? [live] : [])
+            : '[]',
+        });
+      };
+      const result = await Effect.runPromise(
+        Effect.exit(
+          reconcileWithClient(
+            makePsqlExecutor(run, { database: 'postgres', username: 'postgres' }),
+            props,
+            env,
+            exists ? 'stale-seal' : '',
+          ),
+        ),
+      );
+      expect(result._tag).toBe(fail ? 'Failure' : 'Success');
+      const writes = calls.filter((call) => call.stdin.includes('PASSWORD'));
+      expect(writes).toHaveLength(1);
+      expect(writes[0]?.stdin).toContain("PASSWORD E'SCRAM-SHA-256$");
+      expect(JSON.stringify({ calls, result })).not.toContain(password);
+      expect(JSON.stringify(result)).not.toContain('SCRAM-SHA-256$');
+    }
+  }
+});

package/src/postgres/role-privilege.test.ts

@@ -11,6 +11,7 @@ import * as Effect from 'effect/Effect';
 import { makeFakeSql } from './fake-sql.ts';
 import { PostgresRolePrivilegedRefused } from './role-errors.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
+import { diffPostgresRole } from './role-diff.ts';
 import { reconcileWithClient } from './role.ts';
 
 const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
@@ -57,24 +58,50 @@ describe('adopted privilege flags', () => {
     fake.membershipOptions.set('seat-widget\0hf_agent\0postgres', { admin: true, set: true });
     await run(reconcileWithClient(fake, baseProps));
     const texts = fake.statements.map((s) => s.text);
-    // `AddRoleMems` updates the session grantor's row. One full-options GRANT clears ADMIN
-    // and SET without a REVOKE that would drop the membership the declaration still wants.
-    expect(texts).toContain('GRANT "hf_agent" TO "seat-widget" WITH ADMIN FALSE, SET FALSE');
-    expect(texts.some((text) => text.startsWith('REVOKE'))).toBe(false);
+    // Option revocation keeps the membership, while RESTRICT protects dependent grants.
+    expect(texts).toContain(
+      'REVOKE ADMIN OPTION FOR "hf_agent" FROM "seat-widget" GRANTED BY "postgres" RESTRICT',
+    );
+    expect(texts).toContain(
+      'REVOKE SET OPTION FOR "hf_agent" FROM "seat-widget" GRANTED BY "postgres" RESTRICT',
+    );
+    expect(texts.some((text) => text.startsWith('GRANT'))).toBe(false);
     expect(fake.memberships.has('seat-widget\0hf_agent\0postgres')).toBe(true);
     expect(fake.membershipOptions.has('seat-widget\0hf_agent\0postgres')).toBe(false);
   });
 
-  test("another grantor's ADMIN row is revoked by that grantor and the seat grant remains", async () => {
+  test("another grantor's options are revoked while its membership remains", async () => {
     const fake = makeFakeSql({ roleRows: [liveRole()], roles: ['hf_agent'] });
     fake.memberships.add('seat-widget\0hf_agent\0other');
     fake.membershipOptions.set('seat-widget\0hf_agent\0other', { admin: true, set: true });
     await run(reconcileWithClient(fake, baseProps));
     const texts = fake.statements.map((s) => s.text);
-    expect(texts).toContain('GRANT "hf_agent" TO "seat-widget" WITH ADMIN FALSE, SET FALSE');
-    expect(texts).toContain('REVOKE "hf_agent" FROM "seat-widget" GRANTED BY "other"');
-    expect(fake.memberships.has('seat-widget\0hf_agent\0other')).toBe(false);
-    expect(fake.memberships.has('seat-widget\0hf_agent\0postgres')).toBe(true);
-    expect(fake.membershipOptions.has('seat-widget\0hf_agent\0postgres')).toBe(false);
+    expect(texts).toContain(
+      'REVOKE ADMIN OPTION FOR "hf_agent" FROM "seat-widget" GRANTED BY "other" RESTRICT',
+    );
+    expect(texts).toContain(
+      'REVOKE SET OPTION FOR "hf_agent" FROM "seat-widget" GRANTED BY "other" RESTRICT',
+    );
+    expect(fake.memberships.has('seat-widget\0hf_agent\0other')).toBe(true);
+    expect(fake.memberships.has('seat-widget\0hf_agent\0postgres')).toBe(false);
+    expect(fake.membershipOptions.has('seat-widget\0hf_agent\0other')).toBe(false);
   });
 });
+
+test.each(['superuser', 'createrole', 'createdb', 'replication', 'bypassrls'] as const)(
+  'live %s plans update and reconcile refuses before writing',
+  async (flag) => {
+    const live = liveRole({ [flag]: true });
+    expect(await run(diffPostgresRole(baseProps, liveRole(), {}, { found: live }))).toEqual({
+      action: 'update',
+    });
+    const fake = makeFakeSql({ roleRows: [live] });
+    const refused = await run(
+      reconcileWithClient(fake, baseProps, {}).pipe(
+        Effect.catchTag('PostgresRolePrivilegedRefused', (error) => Effect.succeed(error.flags)),
+      ),
+    );
+    expect(refused).toContain(flag.toUpperCase());
+    expect(fake.statements.every((s) => s.text.trimStart().startsWith('SELECT'))).toBe(true);
+  },
+);

package/src/postgres/role-provenance.test.ts

@@ -94,7 +94,7 @@ const EXCLUDED: Readonly<Record<string, string>> = {
     'the create-time membership shorthand; this family writes memberships with one explicit GRANT per parent instead, so the re-read stays authoritative',
   ROLE: 'grants the listed roles membership in the NEW role — the inverse of memberOf; membership is declared in one direction only',
   ADMIN:
-    'grants membership with ADMIN OPTION; a live membership that already has admin_option is revoked and re-granted without it, and the seat GRANT says SET FALSE',
+    'grants membership with ADMIN OPTION; a live admin_option is revoked by grantor with RESTRICT, preserving membership and refusing dependent grants, and the seat GRANT says SET FALSE',
   SYSID:
     'ignored by the server since PostgreSQL 8.1 (the docs keep it only for compatibility); this family never assigns oids',
 };

package/src/postgres/role-provider.ts

@@ -14,7 +14,7 @@ import { PostgresRole } from './role.ts';
 import { readRole, reconcileWithClient, refuseAtPlan } from './role.ts';
 import { diffPostgresRole } from './role-diff.ts';
 import { PostgresRoleIdentityRefused } from './role-errors.ts';
-import { buildDropRoleSql, declarationMatches } from './role-sql.ts';
+import { buildDropRoleSql, declarationMatches, storedAttributes } from './role-sql.ts';
 import { withPg } from './connection.ts';
 
 export const postgresRoleHandlers = PostgresRole.Provider.of({
@@ -40,7 +40,8 @@ export const postgresRoleHandlers = PostgresRole.Provider.of({
         );
       }
       const passwordSeal = output?.passwordSeal ?? '';
-      const found = { ...live, passwordSeal };
+      // Read and reconcile must expose the same shape to Alchemy's drift comparison.
+      const found = { ...storedAttributes(live), passwordSeal };
       return yield* ownedRead(
         { fqn, instanceId, output },
         found,

package/src/postgres/role-refusals.test.ts

@@ -99,31 +99,6 @@ describe('diff', () => {
     }
   });
 
-  test('ADMIN or SET on the live read answers update; stored membership rows do not', async () => {
-    const declared = { ...base, memberOf: ['hf_agent'] as const };
-    const stored = { ...output, memberOf: ['hf_agent'] as const };
-    const row = (admin: boolean, set: boolean) => ({
-      found: {
-        ...stored,
-        memberships: [{ parent: 'hf_agent', grantor: 'postgres', admin, set }],
-      },
-    });
-    expect(await run(diffPostgresRole(declared, stored, {}, row(true, true)))).toEqual({
-      action: 'update',
-    });
-    expect(await run(diffPostgresRole(declared, stored, {}, row(false, true)))).toEqual({
-      action: 'update',
-    });
-    expect(await run(diffPostgresRole(declared, stored, {}, row(false, false)))).toEqual({
-      action: 'noop',
-    });
-    const stuffed = {
-      ...stored,
-      memberships: [{ parent: 'hf_agent', grantor: 'postgres', admin: true, set: true }],
-    };
-    expect(await run(diffPostgresRole(declared, stuffed))).toEqual({ action: 'noop' });
-  });
-
   test('a rotated password answers update even with no other drift; a matching or unreadable one does not', async () => {
     const declared = { ...base, password: { fromEnv: 'PG_SEAT_ROLE_PASSWORD' } as const };
     const stale = seal({ password: 'old' }, 'fixed-salt');

package/src/postgres/role-scram.ts

@@ -28,6 +28,8 @@ const b64 = (value: Buffer): string => value.toString('base64');
 /**
  * `SCRAM-SHA-256$4096:<salt>$<StoredKey>:<ServerKey>` for one password. The salt is fresh per
  * call (same as `psql \password`); tests pass one to make the output deterministic.
+ * Callers first run `assertPasswordAscii`: raw non-ASCII may differ from PostgreSQL's
+ * SASLprep bytes (https://www.postgresql.org/docs/16/sasl-authentication.html).
  */
 export const scramSha256Verifier = (password: string, salt?: Buffer): string => {
   const bytes = salt ?? randomBytes(SALT_BYTES);

package/src/postgres/role-secrets.ts

@@ -11,6 +11,8 @@
  *   written — a plan never re-sends a secret that already matches, and never stores one.
  */
 import * as Redacted from 'effect/Redacted';
+import * as Effect from 'effect/Effect';
+import { PostgresRolePasswordNonAsciiRefused } from './role-errors.ts';
 import { type Environment, resolveAll, seal, sealMatches } from '../secrets/write-only.ts';
 import type { PostgresRoleProps } from './role-attrs.ts';
 
@@ -22,6 +24,19 @@ export interface ResolvedPassword {
   readonly value: Redacted.Redacted<string> | undefined;
 }
 
+/** ⛔ PostgreSQL applies SASLprep before SCRAM, with a raw-byte fallback for prohibited input:
+ * https://www.postgresql.org/docs/16/sasl-authentication.html#SASL-SCRAM-SHA-256
+ * Non-ASCII can normalize to different bytes (e.g. soft hyphen disappears). Refuse before
+ * any write, even with a matching old seal, until we have a vendor-compatible normalizer.
+ * ASCII is unchanged, including prohibited ASCII controls via PostgreSQL's fallback. */
+export const assertPasswordAscii = (
+  role: string,
+  resolved: ResolvedPassword,
+): Effect.Effect<void, PostgresRolePasswordNonAsciiRefused> =>
+  resolved.value !== undefined && /[\u0080-\uffff]/.test(Redacted.value(resolved.value))
+    ? Effect.fail(new PostgresRolePasswordNonAsciiRefused({ role }))
+    : Effect.void;
+
 export const resolvePassword = (
   props: PostgresRoleProps,
   env: Environment = process.env,

package/src/postgres/role-sql.ts

@@ -181,7 +181,9 @@ export const declarationMatches = (
     (props.validUntil === undefined || sameValidUntil(props.validUntil, live.validUntil)) &&
     (wanted === undefined || wanted === found) &&
     privilegedFlags(live).length === 0 &&
-    (live.memberships ?? []).every((row) => !row.admin && !row.set)
+    (live.memberships ?? []).every(
+      (row) => !row.admin && !row.set && (!row.inherit || props.inherit),
+    )
   );
 };
 

package/src/postgres/role.ts

@@ -33,7 +33,12 @@ import type { SqlError } from 'effect/unstable/sql/SqlError';
 import { type Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
 import { nameByteRefusal, validUntilRefusal } from './role-attrs.ts';
-import { passwordMatchesSeal, resolvePassword, sealPassword } from './role-secrets.ts';
+import {
+  assertPasswordAscii,
+  passwordMatchesSeal,
+  resolvePassword,
+  sealPassword,
+} from './role-secrets.ts';
 import { scramSha256Verifier } from './role-scram.ts';
 import {
   buildAlterRoleSql,
@@ -52,6 +57,7 @@ import {
   PostgresRoleNameRefused,
   type PostgresRoleParentMissing,
   PostgresRolePasswordEnvUnsetError,
+  type PostgresRolePasswordNonAsciiRefused,
   PostgresRolePrivilegedRefused,
   PostgresRoleValidUntilRefused,
 } from './role-errors.ts';
@@ -93,6 +99,7 @@ export const reconcileWithClient = (
 ): Effect.Effect<
   PostgresRoleAttributes,
   | PostgresRolePasswordEnvUnsetError
+  | PostgresRolePasswordNonAsciiRefused
   | PostgresRolePrivilegedRefused
   | PostgresRoleCreateVanished
   | PostgresRoleMembershipUnrepaired
@@ -102,6 +109,7 @@ export const reconcileWithClient = (
 > =>
   Effect.gen(function* () {
     const resolved = resolvePassword(props, env);
+    yield* assertPasswordAscii(props.name, resolved);
     const observed = yield* readRoleWithClient(pg, props.name);
     if (observed === undefined) {
       // A create that declares a password must hold it: a LOGIN role with no password set, or

package/src/postgres/schema-socket.test.ts

@@ -49,6 +49,7 @@ const fakeClient = {
 
 // The pool factory is provided to this Effect only; other suites keep the real driver.
 const socket = Layer.merge(
+  // tmp-allow: unix socket directory the driver joins a socket name onto, not a directory this test creates
   postgresConnection({ host: '/tmp', database: 'postgres', username: 'postgres' }),
   Layer.succeed(PostgresPool, (config) => {
     pools.push(config);

package/src/proxmox/generated/constraints/index.ts

@@ -54,4 +54,4 @@ export const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstraints>>
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export const PROXMOX_CONSTRAINTS_DIGEST = '8b6745a471839974';
+export const PROXMOX_CONSTRAINTS_DIGEST = 'cbf63b7bac0500ef';

package/src/proxmox/generated/constraints/pve-access.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-backup.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-ceph.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-firewall.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-ha.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-metrics.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-notifications.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-replication.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-cluster-sdn.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-ceph.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-disks.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-lxc.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-network.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-nodes-qemu.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *
@@ -122,4 +122,9 @@ export const PVE_NODES_QEMU_CONSTRAINTS: Readonly<Record<string, EndpointConstra
     "vmstatestorage": {"format":"pve-storage-id","type":"string"},
     "watchdog": {"format":"pve-qm-watchdog","type":"string"},
   },
+  "pve:PUT /nodes/{node}/qemu/{vmid}/resize": {
+    "digest": {"maxLength":40,"type":"string"},
+    "disk": {"enum":["ide0","ide1","ide2","ide3","scsi0","scsi1","scsi2","scsi3","scsi4","scsi5","scsi6","scsi7","scsi8","scsi9","scsi10","scsi11","scsi12","scsi13","scsi14","scsi15","scsi16","scsi17","scsi18","scsi19","scsi20","scsi21","scsi22","scsi23","scsi24","scsi25","scsi26","scsi27","scsi28","scsi29","scsi30","virtio0","virtio1","virtio2","virtio3","virtio4","virtio5","virtio6","virtio7","virtio8","virtio9","virtio10","virtio11","virtio12","virtio13","virtio14","virtio15","sata0","sata1","sata2","sata3","sata4","sata5","efidisk0","tpmstate0"],"required":true,"type":"string"},
+    "size": {"pattern":"^\\+?\\d+(\\.\\d+)?[KMGT]?\\n?$","patternSource":"\\+?\\d+(\\.\\d+)?[KMGT]?","required":true,"type":"string"},
+  },
 };

package/src/proxmox/generated/constraints/pve-nodes-storage.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-pools.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/generated/constraints/pve-storage.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/src/proxmox/index.ts

@@ -113,6 +113,7 @@ export {
 export { provisionBootstrap } from './provision-bootstrap.ts';
 export { type DeclareProvisionOptions, declareProvisionBaseline } from './provision-declare.ts';
 export { ProxmoxVm, ProxmoxVmProvider, type VmAttributes, type VmProps } from './qemu.ts';
+export { QemuDiskResizeRefused } from './qemu-size.ts';
 export {
   ProxmoxStorageDownload,
   ProxmoxStorageDownloadProvider,